REDHAT-BUG-1121877: Null Pointer Dereference
A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. An unauthenticated attacker could use this flaw to crash the server acceptor.
It is reported that this issue affects version 1.5 and later.
Upstream commit and further details:
https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1121877?
The severity of REDHAT-BUG-1121877 is critical due to the potential for an unauthenticated attacker to crash the server acceptor.
How do I fix REDHAT-BUG-1121877?
To fix REDHAT-BUG-1121877, upgrade to the latest patched version of MIT Kerberos that addresses this NULL pointer dereference flaw.
Which versions of MIT Kerberos are affected by REDHAT-BUG-1121877?
REDHAT-BUG-1121877 affects MIT Kerberos versions 1.5 and later.
What type of flaw is described in REDHAT-BUG-1121877?
REDHAT-BUG-1121877 describes a NULL pointer dereference flaw in the SPNEGO acceptor.
Can REDHAT-BUG-1121877 be exploited remotely?
Yes, an unauthenticated attacker can exploit REDHAT-BUG-1121877 remotely to crash the server.